demo.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Step 1 - Configure the Venafi control plane to for a new Firefly instance. \n",
    "\n",
    "This task would usually be done using the UI, however it can be fully automated using the API. As a convenience, and to get you started using Firefly in the shortest possible time, we will use a utility called \"elevate\" to do this. This will run in a Docker container and we'll use Docker Compose to orchestrate it. However before we can do this you need will need your API key as described in the project documentation. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Set the API Key to connect to your Venafi Control Plane tenant\n",
    "\n",
    "Login to your tenant and copy the API Key associated with your tenant and set it below. The API key that will be used by the Docker compose file to generate a working Firefly configuration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [],
   "source": [
    "export TLSPC_API_KEY=REPLACE_WITH_YOUR_API_KEY_FROM_VENAFI_CLOUD"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Either type the following in the terminal or just click play to run it interactively\n",
    "\n",
    "The below command will create the required configurations in the Venafi Control Plane using API's. \n",
    "The following new items will be created in your tenant after docker command is executed.\n",
    "\n",
    "* Teams : **Firefly Playground**\n",
    "* Service Account: **Firefly Playground**\n",
    "* Sub CA Providers: **Firefly Playground**\n",
    "* Policies: **Firefly Playground**\n",
    "* Configurations: **Firefly Playground**\n",
    "\n",
    "You can optionally run ```docker compose --profile remove-control-plane up``` to cleanup the resources created for demo."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [],
   "source": [
    "docker compose --profile control-plane up"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "You can review the various items created using API's by navigating the UI. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Step 2 - Starting Firefly\n",
    "Run the below command either in the terminal or simply click the play button to start **firefly**\n",
    "\n",
    "Feel free to review the docker compose file available [here](docker-compose.yml)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [],
   "source": [
    "docker compose --profile firefly up"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We will now request a token from the **firefly** that will be subsequently used for requesting certificates\n",
    "Run the below command to set a **TOKEN** in the `.env` file.  "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "jq: error (at <stdin>:1): Malformed BOM (while parsing '��')\n"
     ]
    },
    {
     "ename": "",
     "evalue": "5",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "token=$( curl -d \\\n",
    "     -H \"Content-Type: application/x-www-form-urlencoded\" \\\n",
    "     -X POST http://localhost:8001/token \\\n",
    "     -k -s |  jq -r  '.access_token' )\n",
    "echo VTOKEN=$token > .env\n",
    "echo ${token}\n",
    "echo ${token} | jq -R 'split(\".\") | .[0],.[1] | @base64d | fromjson'\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-----BEGIN CERTIFICATE REQUEST-----\\nMIICvDCCAaQCAQAwdzELMAkGA1UEBhMCR0IxDzANBgNVBAgMBkxvbmRvbjEPMA0G\\nA1UEBwwGTG9uZG9uMRgwFgYDVQQKDA9HbG9iYWwgU2VjdXJpdHkxFjAUBgNVBAsM\\nDUlUIERlcGFydG1lbnQxFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG\\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxY55O/8oTirfdOyBNCbYl6cxJQvNL/iSqG87\\nQbYpdOycvQz3WcmIlk3et0/kxcQiquB3444yAZpKJlAB8oRPl5GWCRR9E4Sl38GO\\nEE61au/g0zVdztcPwJi0fxCHEoaZt3F/4qd2Sc7tuFcyi3ne/uyuFhdlhQ0aM0Wm\\nri3K419NI1a3hIbkffOqPe9MUkTVzkWlbat5t9ZbXE1ZF2T140NoYxx4RqEj1ctL\\nAupcqzI1N0KAHsBrP+E6+6k6f3GtGHsKmQqYviyuRwu7QLrt09P8ORR1TTrNDsJS\\nS/76y8ETUlCe56lBVNiviUjJsB6LmrYWmi67Cod3UXrKoFbnYQIDAQABoAAwDQYJ\\nKoZIhvcNAQELBQADggEBAEA8YYOs66XEMf79NWj2mHQx7Bx/wH5ic1LnMzSGIpXl\\nbEROmkrPEtQhVEZj1jdL7OQlxkdeomq49+nJmloHduOAw5RtkDutnIrJ3HaifmHF\\nQ5QyToVh7lVWAwPsuvvherDdDUg+nZVwrZjBqsz5B30pqGCS0gxtv4SVXlHu0sgY\\njo2qGCbDKzdYUTQvjRS29Rgf7BlN7ss4Q4rAEeCWVhcLJTtotyrIwNqt10mWbG+m\\ndNWs9balRjaIuQfmc1K/s+lzkOdGKrPyUz+Jzc+bzyI8zgsZdSLdapmyOddTgQUj\\ndKK8KKoDtTtj9tWr7ZjsmEnuHLVBp/9axT+F6sF1YeA=\\n-----END CERTIFICATE REQUEST-----\n"
     ]
    }
   ],
   "source": [
    "tmp=$(openssl req -nodes -newkey rsa:2048 -keyout example.key -out - -subj \"/C=GB/ST=London/L=London/O=Global Security/OU=IT Department/CN=example.com\" 2>/dev/null)\n",
    "csr=$( jq -n --arg string \"$tmp\" '$string' | tr -d '\"' )\n",
    "echo $csr\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"error\":\"failed to issue certificate\",\"error_description\":\"token authentication failed: failed to parse JWT: [token is unverifiable: error while executing keyfunc: the given key ID was not found in the JWKS]\"}\n"
     ]
    }
   ],
   "source": [
    "curl 'https://localhost:8289/v1/certificatesigningrequest' \\\n",
    "--header 'Content-Type: application/json' \\\n",
    " -H \"Authorization: Bearer $token\" \\\n",
    "--data '{\n",
    "    \"request\": \"'\"$csr\"'\",\n",
    "    \"policyName\": \"Basic Demo\"\n",
    "}' -k -s #| jq -r .certificateChain"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [],
   "source": [
    "docker exec -it firefly-playground-nginx-1 docker-entrypoint.d/getcert.sh reload"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [],
   "source": [
    "cat <<EOF | grpcurl -plaintext -d @ -unix /root/firefly/spirl/uds/grpc.sock certificates.service.v1alpha1.CertificateRequestService/Create\n",
    "{\n",
    "  \"request\": {\n",
    "    \"policy_name\": \"TLS Server EC Policy\",\n",
    "    \"subject\": {\n",
    "      \"common_name\": \"grpc-over-uds.vena.fi\",\n",
    "      \"org_units\": [\n",
    "        \"Product Management\"\n",
    "      ],\n",
    "      \"organization\": \"Venafi, Inc.\",\n",
    "      \"locality\": \"Salt Lake City\",\n",
    "      \"state\": \"Utah\",\n",
    "      \"country\": \"US\"\n",
    "    },\n",
    "    \"alt_names\": {\n",
    "      \"dns_names\": [\n",
    "        \"grpc-over-uds.vena.fi\"\n",
    "      ],\n",
    "      \"uris\": [\n",
    "        \"spiffe://vena.fi/ns/default/sa/workload\"\n",
    "      ]\n",
    "    },\n",
    "    \"key_type\": \"EC_P256\",\n",
    "    \"validity_period\": \"P3D\"\n",
    "  }\n",
    "}\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "vscode": {
     "languageId": "shellscript"
    }
   },
   "outputs": [],
   "source": [
    "docker run -v ./config:/tmp/tlspc-config mattiasgees/elevate:latest remove -f /tmp/tlspc-config/general-config.yaml --api-key $TLSPC_API_KEY -p \"Basic-demo\" -t \"Basic-demo\" --force\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}